Written submission to the Information Commissionetr’s Office Call for evidence - Age 


T Design Code 


1. Introduction 


This response is builds on a written submission made to the publication by the Information 
Commissioner’s Office on December 21, 2017 of its Draft Guidance recommendations relating to data 
controllers’ compliance with regard to the collection, storage and processing of children’s personal data. 


The Age Appropriate Design Code (Code) marks an important phase in the implementation of 
processes that enable children’s developmental needs and interests to be better accommodated in 
data driven environments. It is important to stress that the Code should be understood not in 
the sense of a separate children’s digital rights policy. There is a clear feeling, not least from the 
debates during the passage of the Data Protection Bill in the House of Lords, information 
society services providers (ISS) that the Code should embed a mindset which embraces the fact 
that as children interact with technologies and content in diverse ways, the opportunities and 
challenges for their growth, learning and flourishing require creative and innovative strategies 
and approaches.' Baroness Kidron’s observation illustrates the rationale for the Code and the 
problem it is intended to solve: 

“Self-regulation has not provided a high bar of data protection for children. On the contrary, we 
have seen a greedy disregard of children’s needs from some sections of the tech sector in their 
eye-watering data collection policies. The introduction of a statutory code makes very clear what 
is required of them, and although data protection is crucial, it is not the only issue that confronts 
children in the digital environment. The principle which these amendments establishes—that a 
child is a child, even online—must now be established in every aspect of a child’s digital life, as a 
cultural and legal norm.” 


In addition to the points raised above, it is also important to recognize that we are at an 
inflection point. As children’s lifeworlds become increasingly connected, there is also a real need 
to raise cultural awareness that technology should not invariably be regarded as a “solution” but 
must be seen as part of a range of choices children, parents and educators should be considering 
when thinking about the developmental needs of the child.’ 


2. Development needs of children at different ages 


The proposal to use age thresholds is an important commencing point through which 
information and communication services providers that can be supported in their efforts to 
better contextualize the mechanisms and strategies to be adopted when taking into account of 
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children’s developmental needs. To this extent the following age brackets are consistent with the 
Convention’s expectation that a child’s evolving capacities is always considered alongside 
prevailing conditions that promote growth, flourishing and capabilities:° 


3-5 
6-9 
10-12 
13-15 
16-17 


Q1. In terms of setting design standards for the processing of children’s personal data by 
providers of ISS (online services), how appropriate you consider the above age brackets 
would be (delete as appropriate): 


Vety appropriate 


It is particularly appropriate as children depending on their state of dependence, interdependence 
and independence interact with communication technologies and social media in different ways 
and not fixed in time.‘ 


Q1A. Please provide any views or evidence on how appropriate you consider the above 
age brackets would be in setting design standards for the processing of children’s 
personal data by providers of ISS (online services) 


Very appropriate also in light of Section 123(7) Data Protection Act 2018: 
“age-appropriate design” means the design of services so that they are appropriate for use by, and 
meet the development needs of, children; (my emphasis) 


The recommendations from the Committee of Ministers to ensure that children’s rights and 
developmental advocate a “child focused” approach to policymaking, in the sense of requiring all 
ISS to regard the foundational principles enshrined in the best interests standard under Article 3 
United Nations Convention on the Rights of the Child (Convention) as the default rule, and 
specifically, to provide the narrative and tools through which information rights and data 
processing principles issues of interpretation, remedies and compliance will now be resolved.” 
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An additional point should also be made at this juncture. The Code should not be regarded as a 
standalone policy instrument. It is equally important to emphasise that the Government also 
beats responsibility in ensuring that ISS take seriously their responsibilities towards children and 
their developmental needs: 

“In preparing a code or amendments under this section, the Commissioner must have regard— 
(a) to the fact that children have different needs at different ages, and 

(b) to the United Kingdom’s obligations under the United Nations Convention on the Rights of 
the Child.” (Section 123(4) Data Protection Act 1998) 


If a coherent and principled strategy towards children is to be embedded, it is not only ISS 
information processing practices that should be regulated but also situations where sharing takes 
place with public sector agencies and authorities which now hold children’s health, education, 
social welfare and criminal justice information.° In passing it should also be noted that there is 
very little public awareness, transparency and accountability of any data sharing arrangements. 


Q2. Please provide any views or evidence you have on children’s development needs, in 
an online context in each or any of the above age brackets. 
See above. 


4. The United Nations Convention on the Rights of the Child 
As noted previously, the Data Protection Act 2018 requires the Commissioner to take account of 
the UK’s obligations under the Convention when drafting the Code. 


Q3. Please provide any views or evidence you have on how the Convention might apply 
in the context of setting design standards for the processing of children’s personal data 
by providers of ISS (online services) 


There is consensus that the Convention provides a principled and coherent framework for 
safeguarding and promoting children and their interests.’ The Council of Europe’s Committee of 
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Ministers recently issued a series of recommendations that reinforce the role and status of 
children’s rights and the UN Convention on the Rights of the Child.’ These recommendations 
succinctly set out the reach of the best interests principle in creating conditions for a child’s 
growth, learning and flourishing namely:’ () Access to the digital environment; (ii) Right to 
freedom of expression and information; (iii) Privacy and data protection; (iv) Right to education; 
and Provision for Meaningful Remedies. 


5. Aspects of design 


The Government has provided the Information Commissioner with a list of areas (which can be 
broadly understood as technologies which now increase children’s wsihility and accessibility as they 
interact with information and services) which will be brought under the scope of the Code: 


s default privacy settings, 

e data minimisation standards, 

$ the presentation and language of terms and conditions and privacy notices, 

e uses of geolocation technology, 

e automated and semi-automated profiling, 

transparency of paid-for activity such as product placement and marketing, 

° the sharing and resale of data, 

° the strategies used to encourage extended user engagement, 

° user reporting and resolution processes and systems, 

° the ability to understand and activate a child’s right to erasure, rectification and 
restriction, 

è the ability to access advice from independent, specialist advocates on all data rights, and 

d any other aspect of design that the commissioner considers relevant. 


When approaching the interplay between ISS and the operation of Convention norms and 
principles, it is not possible to exaggerate the complex and relational shifts introduced into 
childhood, which result from children crossing a “threshold into a world different from 
everything that came before” as soon as they interact with mobile devices, access content and 
services and communicate with others. '° 


Any ground to be made in developing a meaningful and responsive child-focused Code will need 
to ameliorate the consequences of information asymmetries and power imbalance that exists 
between children and ISS. The challenges posed by each of these areas identified as requiring 
regulatory or technological intervention are too well-known to be rehearsed. To this extent, the 
answers given previously extend to the following questions: 

Q4. Please provide any views or evidence you think the Commissioner should take into 
account when explaining the meaning and coverage of these terms in the code. 

Q5. Please provide any views or evidence you have on the following: 
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Q5A. about the opportunities and challenges you think might arise in setting design 
standards for the processing of children’s personal data by providers of ISS (online 
services), in each or any of the above areas. 


Viewed in isolation, these questions make a fundamental assumption about the ease with which 
transparency, education and resilience will help redress longstanding power imbalances and 
information asymmetries." Even where ISS use labeling and rating systems, bundling services in 
exchange for access to personal information render the safeguards illusory.’” In addition to this, 
given that children generate vast volumes of personal data from the use of mobile devices, Apps 
and computers, the Code must demonstrate a clear commitment to hardwiring Convention 
norms and principles into each technology/practice as a default rule.'* An outline will be 
provided of 5 avenues for exploration: 

1. The best interests principle, which requires the child’s Convention interests (and not 
merely the information rights) to be a paramount consideration.” 

2. Privacy by design, rather than the ISS settings functionality (eg geolocation, behavioral 
advertising and marketing) must be a default rule for services, devices, over the top 
services, and Apps. Practices that displace this norm, must be ‘red flagged’ and any use 
must be demonstrated for their equivalence with Convention foundational 
assumptions." 

3. Purpose Limitation, Data Minimisation and Fair Processing rules should be interpreted 
in line with the best interests principle, rather than the much lower threshold which is 
seen as an acceptable compromise for the digital economy."® 

4. Profiling of a child as a norm cannot be seen as being commensurate with the normative 
foundations of the best interests principle. What is the case in the physical world should 
be the norm in the networked environment. Bias, discrimination and inaccuracies can go 
unnoticed and resulting harms may only become manifest when children become adults. 
The present balancing test proposed by the Article 29 Working Party leaves children 
exposed to profiling being normalised through cultural ambivalence to personalised 
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recommendations and individualized marketing recommendations.” It is worth 
reinforcing the recommendation made by the Committee of Ministers:’® 

“Profiling of children, which is any form of automated processing of personal data which 
consists of applying a “profile” to a child, particularly in order to take decisions 
concerning the child or to analyse or predict his or her personal preferences, behaviour 
and attitudes, should be prohibited by law. In exceptional circumstances, States may lift 
this restriction when it is in the best interests of the child or if there is an overriding 
public interest, on the condition that appropriate safeguards are provided for by law.” 

5. Consent and raising children’s awareness to the collection and the monetization of their 
personal information are important to enabling some degree of control. It should be 
noted that consent is only one ground for lawful processing. The role and value of 
consent as an instrument for curbing practices of ISS should not be overstated. Access to 
services tend to be bundled with the expectation that consent would be provided. The 
tights to erasure, rectification and revocation have long been available to children under 
data protection laws. Within this sphere of information rights, it will be imperative to 
develop a sliding scale of accountability (in keeping with the concept of a child’s evolving 
capacity), whereby children above the age of 16 can be assumed to have much deeper 
understanding of how their personal data should be accessed and used. 

6. If we have learnt anything from the Cambridge Analytica Saga, it must be that redress 
and complaint processes are critical to creating a level playing field and ensure that 
abuses of dominance and power are not glossed over. To date there has been very little 
understanding of the role of Article 3 of the Convention as a mechanism for mediating 
interactions between children and ISS. This is a gap that must be filled if children’s voice 
and participation is to be made meaningful. It is suggested that while the mechanisms for 
redress provided by data protection law are invaluable, the best interests principle 
provides an additional layer of constitutional safeguards for children, which prescribes 
what is to be taken into account and how redress and complaint processes are to be 
governed." By way of contrast, the Data Protection Impact Assessment is an example of 
the extent to which data protection law has to evolve towards the adoption of a 
ptincipled and systematic approach to the determination of the impact of processing 
activities on the best interests of the child. There is a sense that data protection rules too 
prioritise the normative imperatives of the digital economy and externalize the social 
costs onto individuals. To help bridge the gap that presently exists in data protection 
policy making and governance, the considerable work and expertise of the Committee on 
the Rights of the Child would expand the avenues through which the Convention’s 
vision of childhood can be embraced.” 
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